From bcadb5d44f2369a6dffa20a30750583c320512f5 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Mon, 12 Jan 2026 10:29:26 +0100
Subject: [PATCH] nixos/sssd: remove unnecessary capabilities

---
 nixos/modules/services/misc/sssd.nix | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix
index 05351a040916..5e00bbc20d97 100644
--- a/nixos/modules/services/misc/sssd.nix
+++ b/nixos/modules/services/misc/sssd.nix
@@ -158,18 +158,9 @@ in
           NotifyAccess = "main";
           PIDFile = "/run/sssd.pid";
           CapabilityBoundingSet = [
-            "CAP_IPC_LOCK"
-            "CAP_CHOWN"
             "CAP_DAC_READ_SEARCH"
-            "CAP_KILL"
-            "CAP_NET_ADMIN"
-            "CAP_SYS_NICE"
-            "CAP_FOWNER"
             "CAP_SETGID"
             "CAP_SETUID"
-            "CAP_SYS_ADMIN"
-            "CAP_SYS_RESOURCE"
-            "CAP_BLOCK_SUSPEND"
           ];
           Restart = "on-abnormal";
           StateDirectory = baseNameOf dataDir;